[APM] Add permissions for "input-only" package

[sorenlouv]

Closes: #164936

This grants the necessary permissions to APM Server when running under fleet.

[apmmachine]

🤖 GitHub comments

Expand to view the GitHub comments

Just comment with:

• /oblt-deploy : Deploy a Kibana instance using the Observability test environments.
• /oblt-deploy-serverless : Deploy a serverless Kibana instance using the Observability test environments.
• run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

[elasticmachine]

Pinging @elastic/apm-ui (Team:APM)

[elasticmachine]

Pinging @elastic/fleet (Team:Fleet)

[sorenlouv]

For reviewer: Remove whitespace to improve readability of this diff: https://github.com/elastic/kibana/pull/166234/files?diff=unified&w=1#r1329801250

[yngrdyn]

APM changes LGTM 🧑‍🏫

[juliaElastic]

Fleet changes LGTM

[kibana-ci]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: 0f9f73f

Failed CI Steps

• FTR Configs #54

Test Failures

• [job] [logs] FTR Configs #54 / serverless search UI empty pages should show search specific empty page in discover

Metrics [docs]

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
fleet	1083	1082	-1

Unknown metric groups

API count

id	before	after	diff
fleet	1201	1200	-1

History

• 💔 Build #161642 failed 9f8e63d
• 💔 Build #161490 failed 579c2ce
• 💔 Build #161468 failed 80e0fa1
• 💔 Build #161448 failed cba491a
• 💔 Build #161354 failed f6de10e

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

[sorenlouv]

✅ Test plan 8.11

Tested this by applying re-route processors.

Namespace re-routing

PUT _ingest/pipeline/traces-apm@custom
{
  "processors": [
    {
      "reroute": {
        "namespace": "{{agent.name}}" 
      }
    }
  ]
}

Traces were re-routed to .ds-traces-apm-nodejs-2023.10.05-000001

Dataset re-rerouting

PUT _ingest/pipeline/traces-apm@custom
{
  "processors": [
    {
      "reroute": {
        "dataset": "{{agent.name}}" 
      }
    }
  ]
}

Traces were rerouted to traces-nodejs-default

This means that nothing is broken as a result of the input-only packages changes and APM Server is still able to ingest as expected. Whether the new permissions actually work will be tested out in the next release when APM Server starts taking advantage of this.